Florentin Guth, Valentin Wüstholz, Maria Christakis, Péter Müller
Smart contracts are programs that manage digital assets according to a certain protocol, expressing for instance the rules of an auction. Understanding the possible behaviors of a smart contract is difficult, which complicates development, auditing, and the post-mortem analysis of attacks. This paper presents the first specification mining technique for smart contracts. Our technique extracts the possible behaviors of smart contracts from contract executions recorded on a blockchain and expresses them as finite automata. A novel dependency analysis allows us to separate independent interactions with a contract. Our technique tunes the abstractions for the automata construction automatically based on configurable metrics, for instance, to maximize readability or precision. We implemented our technique for the Ethereum blockchain and evaluated its usability on several real-world contracts.
Recently, public interest in the blockchain technology has surged and various applications based on the technology have emerged. However, there has been little study on architectural evaluations of popular block chain platforms that can help the developers choose an appropriate architecture matching their needs. In this paper, we reconstruct and evaluate the architecture of Hyperledger and Ethereum, which are representative open source platforms for blockchain. The evaluation results indicate that Hyperledger is strong in modifiability and performance whereas Ethereum is better in security.
Kapil Singi, D S Pradeepkumar, Vikrant Kaulgud, Sanjay Podder
In this extended abstract, we propose a conceptual framework that leverages distributed ledger technology and smart contracts to create a decentralized system to capture the occurrence of interesting development activities (e.g., a development build) and associated contextual data, and automatically audit and evaluate compliance to governance policies. Our hypothesis is that such a framework will facilitate easier sharing of information across all participants of a distributed development team, compliance evaluation and early mitigation actions, leading to greater visibility and compliance. Currently, the proof of concept we are working on is focused on sharing and compliance evaluation of the open-source components used in software development.
Valentina Lenarduzzi, Maria Ilaria Lunesu, Michele Marchesi, Roberto Tonelli
We present an application of Blockchain technology and Smart Contracts to the management of Agile projects, using Scrum or Lean-Kanban processes. In our application the duties of the Product Owner for certifying the correctness of the outcomes are delegated to one or more Smart Contracts deployed on the Ethereum Blockchain and written in Solidity. An agreement with the Customer can also allow the Smart Contracts to automatically enable payments, to introduce penalties or grants on the basis of the outcome. Product Owner duties and work can thus be relieved allowing to allocate resources on more profitable and productive tasks. Other possibilities are examined as well.
Reproducibility is the ability of recreating identical binaries under pre-defined build environments. Due to the need of quality assurance and the benefit of better detecting attacks against build environments, the practice of reproducible builds has gained popularity in many open-source software repositories such as Debian and Bitcoin. However, identifying the unreproducible issues remains a labour intensive and time consuming challenge, because of the lacking of information to guide the search and the diversity of the causes that may lead to the unreproducible binaries. In this paper we propose an automated framework called RepLoc to localize the problematic files for unreproducible builds. RepLoc features a query augmentation component that utilizes the information extracted from the build logs, and a heuristic rule-based filtering component that narrows the search scope. By integrating the two components with a weighted file ranking module, RepLoc is able to automatically produce a ranked list of files that are helpful in locating the problematic files for the unreproducible builds. We have implemented a prototype and conducted extensive experiments over 671 real-world unreproducible Debian packages in four different categories. By considering the topmost ranked file only, RepLoc achieves an accuracy rate of 47.09%. If we expand our examination to the top ten ranked files in the list produced by RepLoc, the accuracy rate becomes 79.28%. Considering that there are hundreds of source code, scripts, Makefiles, etc., in a package, RepLoc significantly reduces the scope of localizing problematic files. Moreover, with the help of RepLoc, we successfully identified and fixed six new unreproducible packages from Debian and Guix.
Roberto Tonelli, G. A. Pierro, Marco Ortu, Giuseppe Destefanis
Smart contracts (SC) are software programs that reside and run over a blockchain. The code can be written in different languages with the common purpose of implementing various kinds of transactions onto the hosting blockchain. They are ruled by the blockchain infrastructure with the intent to automatically implement the typical conditions of traditional contracts. Programs must satisfy context-dependent constraints which are quite different from traditional software code. In particular, since the bytecode is uploaded in the hosting blockchain, the size, computational resources, interaction between different parts of the program are all limited. This is true even if the specific programming languages implement more or less the same constructs as that of traditional languages: there is not the same freedom as in normal software development. The working hypothesis used in this article is that Smart Contract specific constraints should be captured by specific software metrics (that may differ from traditional software metrics). We tested this hypothesis on 85K Smart Contracts written in Solidity and uploaded on the Ethereum blockchain. We analyzed Smart Contracts from two repositories "Etherscan" and "Smart Corpus" and we computed the statistics of a set of software metrics related to Smart Contracts and compared them to the metrics extracted from more traditional software projects. Our results show that generally, Smart Contract metrics have more restricted ranges than the corresponding metrics in traditional software systems. Some of the stylized facts, like power law in the tail of the distribution of some metrics, are only approximate but the lines of code follow a log-normal distribution which reminds us of the same behaviour already found in traditional software systems.
Shinsaku Kiyomoto, Mohammad Shahriar Rahman, Anirban Basu
In this paper, we design a distributed platform for anonymized dataset trading without any centralized trusted third party. The platform consists of peers and consensus-based blockchain mechanism, and each peer acts as a data broker, data receiver, or verifier for blockchain in a data transfer transaction. A data broker collects data from data owners under their consent for data trading. The Privacy Policy Manager (PPM) manages the consent information and confirms them on behalf of data owners, when data distribution is requested from data broker. We implement a prototype system of the platform using an open-source blockchain mechanism, Hyperledger Fabric, and provide evaluation results of the prototype system.
Bugs severely hurt blockchain system dependability. A thorough understanding of blockchain bug characteristics is required to design effective tools for preventing, detecting and mitigating bugs. We perform an empirical study on bug characteristics in eight representative open source blockchain systems. First, we manually examine 1,108 bug reports to understand the nature of the reported bugs. Second, we leverage card sorting to label the bug reports, and obtain ten bug categories in blockchain systems. We further investigate the frequency distribution of bug categories across projects and programming languages. Finally, we study the relationship between bug categories and bug fixing time. The findings include: (1) semantic bugs are the dominant runtime bug category, (2) frequency distributions of bug types show similar trends across different projects and programming languages, (3) security bugs take the longest median time to be fixed, (4) 35.71% performance bugs are fixed in more than one year, performance bugs take the longest average time to be fixed.
Simone Porru, Andrea Pinna, Michele Marchesi, Roberto Tonelli
The Blockchain technology is reshaping finance, economy, money to the extent that its disruptive power is compared to that of the Internet and the Web in their early days. As a result, all the software development revolving around the Blockchain technology is growing at a staggering rate. In this paper, we acknowledge the need for software engineers to devise specialized tools and techniques for blockchain-oriented software development. From current challenges concerning the definition of new professional roles, demanding testing activities and novel tools for software architecture, we take a step forward by proposing new directions on the basis of a curate corpus of blockchain-oriented software repositories, detected by exploiting the information enclosed in the 2016 Moody's Blockchain Report and teh market capitalization of cryptocurrencies. Ensuring effective testing activities, enhancing collaboration in large teams, and facilitating the development of smart contracts all appear as key factors in the future of blockchain-oriented software development.
Large-scale organizations, such as Siemens, develop a broad field of products for varying domains. Software constitutes a major innovation and cost factor to their development. Organizational-wide reuse of software across products, even across domains, gives these organizations a competitive advantage. This involves large-scale reuse approaches where software is developed in a decentralized manner by several internal, yet self-contained organizational units -- those units are separate profit centers with own business objectives, organizationally independent with own product management, and have widely autonomous processes and software-engineering life cycles. I define those systems as internal software ecosystems. The intra-organizational, yet decentralized development context increases the amount and complexity of dependencies among both software assets and the responsible organizational units. This significantly impacts collaboration in software engineering. Traditional process-centric coordination mechanisms become increasingly inefficient, calling for a suitable software architecture to enable effective collaboration. However, in order to make informed architecture decisions, applied modes of collaboration and resulting architecture challenges must be understood. As first major contribution in this thesis, I provide strong empirical evidence on collaboration and resulting architecture challenges for two of the largest internal software ecosystems at Siemens -- based on a total of 46 hours of semi-structured interviews with 17 leading software architects from all involved organizational units. I identify three collaboration models on a continuum that ranges from high to low coupling and a classification of architecture challenges together with a qualitative and quantitative exposure of the identified recurring hurdles. My results outline a broad field of real-world challenges that need to be investigated by researchers, and my results support practitioners who follow the collaboration models to make informed architecture decisions based on empirical evidence. Besides taking informed architecture decisions, it is equally important to manage and control adherence to the specified architecture at an ecosystem-wide level. However, feature and schedule pressure regularly require to accept architecture violations by several organizational units, which decreases quality and increases maintenance costs. As main finding of my investigation on collaboration and architecture challenges, I identify the explicit and systematic management of architecture violations as the key challenge for internal software ecosystems, in particular the lack of developer support for resolving violations. As second major contribution within this thesis, I elaborate the TrAViM approach, a framework that comprises seven violation-management capabilities for internal software ecosystems. Their main purpose is developer support for resolving architecture violations, aiming to reduce the developers' effort required to handle them. I develop a prototype that instantiates the approach. Using the prototype, I conduct an in-depth case study on the capabilities' usefulness, involving 9 experts from my study systems. All of them expressed that the capabilities are highly valuable and hold great potential to ease violation management for large-scale software engineering.
Open source software development (OSSD) is a community-oriented, network-centric approach to building complex software systems. OSSD projects are typically organized as virtual enterprises that lack an explicit managerial regime to control and coordinate decentralized project work. However, a growing number of OSSD projects are developing, delivering, and supporting large-scale software systems that are displacing proprietary software alternatives. Recent empirical studies of OSSD projects reveal that OSS developers often self-organize into organizational forms we characterize as evolving socio-technical interaction networks (STINs). These STINs emerge in ways that effectively control semi-autonomous OSS developers and coordinate project activities to produce reliable and adaptive software systems. In this paper, we examine how practices and processes enable and govern decentralized organizations like OSSD projects when coalesced and configured as contingent, socio-technical interaction networks. In so doing, we draw on results from two ongoing case studies of leadership and governance activities and elements in a small and a large OSSD project.
This chapter contributes to the sociological understanding of open source software (OSS) production by identifying the social mechanism that creates social order in OSS communities. OSS communities are identified as production communities whose mode of production employs autonomous decentralized decision making on contributions and autonomous production of contributions while maintaining the necessary order by adjustment to the common subject matter of work. Thus, OSS communities belong to the same type of collective production system as scientific communities. Both consist of members who not only work on a common product, but are also aware of this collective work and adjust their actions accordingly. Membership is based on the self-perception of working with the community’s subject matter (software or respectively scientific knowledge). The major differences between the two are due to the different subject matters of work. Production communities are compared to the previously known collective production systems, namely, markets, organizations, and networks. They have a competitive advantage in the production under complete uncertainty, that is, when neither the nature of a problem, nor the way in which it can be solved, nor the skills required for its solution are known in advance.Request access from your librarian to read this chapter's full text.
A key challenge for software engineering is to learn how to reconcile the formal world of the machine and its software with the non-formal real world. In this paper, we describe Problem Oriented Software Engineering (POSE), an approach that brings both non-formal and formal aspects of software development together within a single theoretical framework for software engineering design. We show how POSE captures development as the recordable and re-playable design theoretic transformation of software problems. Their representation and transformation allows for the identification and clarification of system requirements, the understanding and structuring of the problem world, the structuring and specification of a hard-ware/software machine that can ensure satisfaction of the requirements in the problem world, and the construction of adequacy arguments, convincing both to developers and to customers, users and other interested stake-holders, that the system will provide what is needed. Designs are recordable and re-playable through our adaptation of tactics, a (now standard) form of programming language used in transformational proof theoretic presentations. This brings to our system many other benefits of such approaches, including the ability to abstract from a captured design, and to combine programmatically captured designs. This paper provides an example-driven presentation of our framework for software engineering design.
Portability is defined as the capacity of an educational software item to be used differently from the way, the objectives, or the environment in which it was originally conceived. There are obvious economic strategies for increasing the portability of educational software. Computer software has high fixed costs and extremely low variable costs. In principle, portability would lead to greater utilization, reducing unit costs and increasing quality, thus leading to higher cost effectiveness. However, the nature and behavior of both centralized and decentralized education systems set limits to the exercise of pure economic rationality. The paper discusses both the limits of educational software markets and the potential effects of government policies to increase the portability of educational software. Three major findings derived from empirical observation and economic analysis are discussed. First, high fixed costs associated with very low variable costs make higher usage, and hence portability, particularly attractive. Second, given the peculiarities of educational markets, the way governments finance schools are relatively more important than the price of software: Teachers are more likely to buy, adapt, or develop programs according to the logic of local financing policies rather than cost considerations. Third, both markets and governments influence portability and the willingness of producers to develop portable computer-education software. Government policies that can be particularly effective to improve portability are financing and incentive systems, licensing, copyright agreements, and regulatory policies concerning systems compatibility. The provision of support functions through clearinghouses for exchange of information, training, research and development, and feedback to producers can also help correct for market imperfections.